Device unlock method update scenarios

Overview

If the end user enables a secure lock screen and the issuer application sets biometric or device credentials (keyguard) as the CDCVM method, handle device unlock changes carefully.

Some changes invalidate the key material stored in Android Keystore. NFC Wallet SDK detects this only when it accesses the keystore. During payment, the issuer application may then fail to retrieve cards and receive a CARD_NOT_EXISTING exception.

The following scenarios summarize the expected behavior.

Scenarios

Scenario	OS	SDK	Digital wallet application
End user disables the secure lock screen	Invalidates the key material in Android Keystore. Android does not notify the digital wallet application when this happens.	Detects the invalid key material only when it accesses the keystore.	During payment, does not find any cards and receives a CARD_NOT_EXISTING exception.
End user changes the secure lock screen type, for example from fingerprint to passcode, or from passcode to PIN	No action.	No action.	Optionally detect this change at startup or in a background check, based on your issuer application logic.
End user disables the secure lock screen, then enables it again	Invalidates the key material as soon as the secure lock screen is disabled.	Detects the invalid key material only when it accesses the keystore.	During payment, does not find any cards and receives a CARD_NOT_EXISTING exception.
End user adds a new fingerprint	No action.	No action.	No action.
End user removes all fingerprints	Invalidates the key material in Android Keystore if the digital wallet application uses biometric as the CDCVM method.	If biometric is used as the CDCVM method, detects the invalid key material only when it accesses the keystore.	If biometric is used as the CDCVM method, during payment does not find any cards and receives a CARD_NOT_EXISTING exception.